--- /dev/null
+From 27c5fb7a84242b66bf1e0b2fe6bf40d19bcc5c04 Mon Sep 17 00:00:00 2001
+From: Horia Geanta <horia.geanta@freescale.com>
+Date: Fri, 18 Apr 2014 13:01:42 +0300
+Subject: crypto: caam - add allocation failure handling in SPRINTFCAT macro
+
+From: Horia Geanta <horia.geanta@freescale.com>
+
+commit 27c5fb7a84242b66bf1e0b2fe6bf40d19bcc5c04 upstream.
+
+GFP_ATOMIC memory allocation could fail.
+In this case, avoid NULL pointer dereference and notify user.
+
+Cc: Kim Phillips <kim.phillips@freescale.com>
+Signed-off-by: Horia Geanta <horia.geanta@freescale.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/crypto/caam/error.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/crypto/caam/error.c
++++ b/drivers/crypto/caam/error.c
+@@ -16,9 +16,13 @@
+ char *tmp; \
+ \
+ tmp = kmalloc(sizeof(format) + max_alloc, GFP_ATOMIC); \
+- sprintf(tmp, format, param); \
+- strcat(str, tmp); \
+- kfree(tmp); \
++ if (likely(tmp)) { \
++ sprintf(tmp, format, param); \
++ strcat(str, tmp); \
++ kfree(tmp); \
++ } else { \
++ strcat(str, "kmalloc failure in SPRINTFCAT"); \
++ } \
+ }
+
+ static void report_jump_idx(u32 status, char *outstr)
--- /dev/null
+From 3901c1124ec5099254a9396085f7798153a7293f Mon Sep 17 00:00:00 2001
+From: Harald Freudenberger <freude@linux.vnet.ibm.com>
+Date: Wed, 7 May 2014 16:51:29 +0200
+Subject: crypto: s390 - fix aes,des ctr mode concurrency finding.
+
+From: Harald Freudenberger <freude@linux.vnet.ibm.com>
+
+commit 3901c1124ec5099254a9396085f7798153a7293f upstream.
+
+An additional testcase found an issue with the last
+series of patches applied: the fallback solution may
+not save the iv value after operation. This very small
+fix just makes sure the iv is copied back to the
+walk/desc struct.
+
+Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/crypto/aes_s390.c | 3 +++
+ arch/s390/crypto/des_s390.c | 3 +++
+ 2 files changed, 6 insertions(+)
+
+--- a/arch/s390/crypto/aes_s390.c
++++ b/arch/s390/crypto/aes_s390.c
+@@ -818,6 +818,9 @@ static int ctr_aes_crypt(struct blkciphe
+ else
+ memcpy(walk->iv, ctrptr, AES_BLOCK_SIZE);
+ spin_unlock(&ctrblk_lock);
++ } else {
++ if (!nbytes)
++ memcpy(walk->iv, ctrptr, AES_BLOCK_SIZE);
+ }
+ /*
+ * final block may be < AES_BLOCK_SIZE, copy only nbytes
+--- a/arch/s390/crypto/des_s390.c
++++ b/arch/s390/crypto/des_s390.c
+@@ -429,6 +429,9 @@ static int ctr_desall_crypt(struct blkci
+ else
+ memcpy(walk->iv, ctrptr, DES_BLOCK_SIZE);
+ spin_unlock(&ctrblk_lock);
++ } else {
++ if (!nbytes)
++ memcpy(walk->iv, ctrptr, DES_BLOCK_SIZE);
+ }
+ /* final block may be < DES_BLOCK_SIZE, copy only nbytes */
+ if (nbytes) {
--- /dev/null
+From e028a9e6b8a637af09ac4114083280df4a7045f1 Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Tue, 22 Apr 2014 10:08:40 -0600
+Subject: iommu/amd: Fix interrupt remapping for aliased devices
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+commit e028a9e6b8a637af09ac4114083280df4a7045f1 upstream.
+
+An apparent cut and paste error prevents the correct flags from being
+set on the alias device resulting in MSI on conventional PCI devices
+failing to work. This also produces error events from the IOMMU like:
+
+AMD-Vi: Event logged [INVALID_DEVICE_REQUEST device=00:14.4 address=0x000000fdf8000000 flags=0x0a00]
+
+Where 14.4 is a PCIe-to-PCI bridge with a device behind it trying to
+use MSI interrupts.
+
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Joerg Roedel <joro@8bytes.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/amd_iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -3959,7 +3959,7 @@ static struct irq_remap_table *get_irq_t
+ iommu_flush_dte(iommu, devid);
+ if (devid != alias) {
+ irq_lookup_table[alias] = table;
+- set_dte_irq_entry(devid, table);
++ set_dte_irq_entry(alias, table);
+ iommu_flush_dte(iommu, alias);
+ }
+
--- /dev/null
+From 178eda29ca721842f2146378e73d43e0044c4166 Mon Sep 17 00:00:00 2001
+From: Chunwei Chen <tuxoko@gmail.com>
+Date: Wed, 23 Apr 2014 12:35:09 +0800
+Subject: libceph: fix corruption when using page_count 0 page in rbd
+
+From: Chunwei Chen <tuxoko@gmail.com>
+
+commit 178eda29ca721842f2146378e73d43e0044c4166 upstream.
+
+It has been reported that using ZFSonLinux on rbd will result in memory
+corruption. The bug report can be found here:
+
+https://github.com/zfsonlinux/spl/issues/241
+http://tracker.ceph.com/issues/7790
+
+The reason is that ZFS will send pages with page_count 0 into rbd, which in
+turns send them to tcp_sendpage. However, tcp_sendpage cannot deal with
+page_count 0, as it will do get_page and put_page, and erroneously free the
+page.
+
+This type of issue has been noted before, and handled in iscsi, drbd,
+etc. So, rbd should also handle this. This fix address this issue by fall back
+to slower sendmsg when page_count 0 detected.
+
+Cc: Sage Weil <sage@inktank.com>
+Cc: Yehuda Sadeh <yehuda@inktank.com>
+Signed-off-by: Chunwei Chen <tuxoko@gmail.com>
+Reviewed-by: Ilya Dryomov <ilya.dryomov@inktank.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ceph/messenger.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -556,7 +556,7 @@ static int ceph_tcp_sendmsg(struct socke
+ return r;
+ }
+
+-static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
++static int __ceph_tcp_sendpage(struct socket *sock, struct page *page,
+ int offset, size_t size, bool more)
+ {
+ int flags = MSG_DONTWAIT | MSG_NOSIGNAL | (more ? MSG_MORE : MSG_EOR);
+@@ -569,6 +569,24 @@ static int ceph_tcp_sendpage(struct sock
+ return ret;
+ }
+
++static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
++ int offset, size_t size, bool more)
++{
++ int ret;
++ struct kvec iov;
++
++ /* sendpage cannot properly handle pages with page_count == 0,
++ * we need to fallback to sendmsg if that's the case */
++ if (page_count(page) >= 1)
++ return __ceph_tcp_sendpage(sock, page, offset, size, more);
++
++ iov.iov_base = kmap(page) + offset;
++ iov.iov_len = size;
++ ret = ceph_tcp_sendmsg(sock, &iov, 1, size, more);
++ kunmap(page);
++
++ return ret;
++}
+
+ /*
+ * Shutdown/close the socket for the given connection.
--- /dev/null
+From 8845cc6415ec28ef8d57b3fb81c75ef9bce69c5f Mon Sep 17 00:00:00 2001
+From: Antti Palosaari <crope@iki.fi>
+Date: Thu, 10 Apr 2014 21:18:16 -0300
+Subject: media: fc2580: fix tuning failure on 32-bit arch
+
+From: Antti Palosaari <crope@iki.fi>
+
+commit 8845cc6415ec28ef8d57b3fb81c75ef9bce69c5f upstream.
+
+There was some frequency calculation overflows which caused tuning
+failure on 32-bit architecture. Use 64-bit numbers where needed in
+order to avoid calculation overflows.
+
+Thanks for the Finnish person, who asked remain anonymous, reporting,
+testing and suggesting the fix.
+
+Signed-off-by: Antti Palosaari <crope@iki.fi>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/tuners/fc2580.c | 6 +++---
+ drivers/media/tuners/fc2580_priv.h | 1 +
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/tuners/fc2580.c
++++ b/drivers/media/tuners/fc2580.c
+@@ -195,7 +195,7 @@ static int fc2580_set_params(struct dvb_
+
+ f_ref = 2UL * priv->cfg->clock / r_val;
+ n_val = div_u64_rem(f_vco, f_ref, &k_val);
+- k_val_reg = 1UL * k_val * (1 << 20) / f_ref;
++ k_val_reg = div_u64(1ULL * k_val * (1 << 20), f_ref);
+
+ ret = fc2580_wr_reg(priv, 0x18, r18_val | ((k_val_reg >> 16) & 0xff));
+ if (ret < 0)
+@@ -348,8 +348,8 @@ static int fc2580_set_params(struct dvb_
+ if (ret < 0)
+ goto err;
+
+- ret = fc2580_wr_reg(priv, 0x37, 1UL * priv->cfg->clock * \
+- fc2580_if_filter_lut[i].mul / 1000000000);
++ ret = fc2580_wr_reg(priv, 0x37, div_u64(1ULL * priv->cfg->clock *
++ fc2580_if_filter_lut[i].mul, 1000000000));
+ if (ret < 0)
+ goto err;
+
+--- a/drivers/media/tuners/fc2580_priv.h
++++ b/drivers/media/tuners/fc2580_priv.h
+@@ -22,6 +22,7 @@
+ #define FC2580_PRIV_H
+
+ #include "fc2580.h"
++#include <linux/math64.h>
+
+ struct fc2580_reg_val {
+ u8 reg;
--- /dev/null
+From 7998eb3dc700aaf499f93f50b3d77da834ef9e1d Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Thu, 15 May 2014 09:33:42 -0700
+Subject: powerpc: Fix 64 bit builds with binutils 2.24
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 7998eb3dc700aaf499f93f50b3d77da834ef9e1d upstream.
+
+With binutils 2.24, various 64 bit builds fail with relocation errors
+such as
+
+arch/powerpc/kernel/built-in.o: In function `exc_debug_crit_book3e':
+ (.text+0x165ee): relocation truncated to fit: R_PPC64_ADDR16_HI
+ against symbol `interrupt_base_book3e' defined in .text section
+ in arch/powerpc/kernel/built-in.o
+arch/powerpc/kernel/built-in.o: In function `exc_debug_crit_book3e':
+ (.text+0x16602): relocation truncated to fit: R_PPC64_ADDR16_HI
+ against symbol `interrupt_end_book3e' defined in .text section
+ in arch/powerpc/kernel/built-in.o
+
+The assembler maintainer says:
+
+ I changed the ABI, something that had to be done but unfortunately
+ happens to break the booke kernel code. When building up a 64-bit
+ value with lis, ori, shl, oris, ori or similar sequences, you now
+ should use @high and @higha in place of @h and @ha. @h and @ha
+ (and their associated relocs R_PPC64_ADDR16_HI and R_PPC64_ADDR16_HA)
+ now report overflow if the value is out of 32-bit signed range.
+ ie. @h and @ha assume you're building a 32-bit value. This is needed
+ to report out-of-range -mcmodel=medium toc pointer offsets in @toc@h
+ and @toc@ha expressions, and for consistency I did the same for all
+ other @h and @ha relocs.
+
+Replacing @h with @high in one strategic location fixes the relocation
+errors. This has to be done conditionally since the assembler either
+supports @h or @high but not both.
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/Makefile | 4 +++-
+ arch/powerpc/include/asm/ppc_asm.h | 7 ++++++-
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -97,7 +97,9 @@ CFLAGS-$(CONFIG_POWER7_CPU) += $(call cc
+
+ CFLAGS-$(CONFIG_TUNE_CELL) += $(call cc-option,-mtune=cell)
+
+-KBUILD_CPPFLAGS += -Iarch/$(ARCH)
++asinstr := $(call as-instr,lis 9$(comma)foo@high,-DHAVE_AS_ATHIGH=1)
++
++KBUILD_CPPFLAGS += -Iarch/$(ARCH) $(asinstr)
+ KBUILD_AFLAGS += -Iarch/$(ARCH)
+ KBUILD_CFLAGS += -msoft-float -pipe -Iarch/$(ARCH) $(CFLAGS-y)
+ CPP = $(CC) -E $(KBUILD_CFLAGS)
+--- a/arch/powerpc/include/asm/ppc_asm.h
++++ b/arch/powerpc/include/asm/ppc_asm.h
+@@ -390,11 +390,16 @@ n:
+ * ld rY,ADDROFF(name)(rX)
+ */
+ #ifdef __powerpc64__
++#ifdef HAVE_AS_ATHIGH
++#define __AS_ATHIGH high
++#else
++#define __AS_ATHIGH h
++#endif
+ #define LOAD_REG_IMMEDIATE(reg,expr) \
+ lis reg,(expr)@highest; \
+ ori reg,reg,(expr)@higher; \
+ rldicr reg,reg,32,31; \
+- oris reg,reg,(expr)@h; \
++ oris reg,reg,(expr)@__AS_ATHIGH; \
+ ori reg,reg,(expr)@l;
+
+ #define LOAD_REG_ADDR(reg,name) \
i2c-rcar-bail-out-on-zero-length-transfers.patch
i2c-designware-mask-all-interrupts-during-i2c-controller-enable.patch
i2c-s3c2410-resume-race-fix.patch
+crypto-caam-add-allocation-failure-handling-in-sprintfcat-macro.patch
+crypto-s390-fix-aes-des-ctr-mode-concurrency-finding.patch
+powerpc-fix-64-bit-builds-with-binutils-2.24.patch
+libceph-fix-corruption-when-using-page_count-0-page-in-rbd.patch
+iommu-amd-fix-interrupt-remapping-for-aliased-devices.patch
+media-fc2580-fix-tuning-failure-on-32-bit-arch.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
